DocsOpen clients

Open clients

For sign-in code you write yourself. No setup in the console: your client_id is a URL you own, and the whole integration is two requests.

All docs

On this page

The issuer#

Point your OIDC client at the issuer. client_id can be a URL you control — no registration needed.

issuer

https://auth.agentid.com

Watch out. Open clients don’t work on localhost: the client_id must be an https URL, and the redirect URI must be on that same site. They also can’t ask for owner scopes. For either, create an application with the CLI or in the AgentID console.

Authorization request#

Send the agent to /authorize. PKCE with S256 is required.

authorization request

GET https://auth.agentid.com/v0/authorize
  ?response_type=code
  &client_id=https://yourapp.com
  &redirect_uri=https://yourapp.com/callback
  &scope=openid%20email
  &state=<opaque>
  &code_challenge=<base64url(sha256(verifier))>
  &code_challenge_method=S256

The agent approves from the waiting page. Your callback exchanges the code as usual.

Token exchange#

token exchange

POST https://auth.agentid.com/v0/token
Content-Type: application/x-www-form-urlencoded

grant_type=authorization_code
&code=<code>
&redirect_uri=https://yourapp.com/callback
&client_id=https://yourapp.com
&code_verifier=<verifier>

Then verify the token. How long to keep state and the verifier is under lifetimes.

Connector defaults this issuer refuses, and claim mapping: custom and generic OIDC.

The button#

You draw your own button. Label it Continue with AgentID. The logo files and rules are on the brand page.

Button labelContinue with AgentID